They dont have to be connected to the internet directly, the attackers can move laterally across segmented network boundaries or deliver a USB or backdoored device implant for their initial access.
Which is why you dont get to bring your equipment into those facilities. But someone always thinks he is the exception to the rule. What harm could a USB stick do and you really need your powerpoint slides.
